CVE-2026-62303

Name of the Vulnerable Software and Affected Versions Pistache versions 0.0.5 through 0.4.26

Description The SegmentTreeNode::sanitizeResource() function in src/server/router.cc uses std::regex replace() with the //+ expression to collapse consecutive slashes. When using libstdc++, a path containing tens of thousands of consecutive slash characters can cause deep recursion, leading to stack exhaustion and a process crash. This issue is reachable via the Router::route(), Router::addRoute(), and Router::removeRoute() functions. Unauthenticated remote exploitation is possible if the deployment allows long request paths, such as by increasing the Endpoint::Options::maxRequestSize() variable above the default 4096-byte limit or by forwarding long paths through a front end. Direct use of the router API is also affected when attacker-controlled route or resource strings reach the normalizer.

Recommendations For versions 0.0.5 through 0.4.26, replace the recursive regular-expression normalization in SegmentTreeNode::sanitizeResource() with an iterative pass. As a temporary mitigation, maintain the Endpoint::Options::maxRequestSize() at its default 4096-byte limit or restrict the length of request paths forwarded through front-end systems.